In IRM architecture, how does a risk statement relate to a risk on a wastewater plant entity—parallel to control objective versus control?
Select an answer to reveal the explanation.
Short Explanation
Same idea as a recipe versus tonight’s dinner. The risk statement is the reusable definition; the risk is that definition living on a real entity like the wastewater plant. Mixing those up is like confusing the cookbook with the plated meal.
Full Explanation
In IRM architecture, the risk statement is the reusable definition; the risk is the scoped instance on the entity—parallel to control objective versus generated control. For a wastewater plant, the statement defines the risk language once; scoping creates the plant’s owned, scored risk. Treating the statement as always the scored residual and the risk as a UI bookmark fails by concept because scoring lives on the scoped risk instance. Calling statement and risk identical synonyms fails by concept because reuse versus entity scoping is the architectural point. Reversing the relationship—claiming the risk is reusable and the statement is the entity scorecard—fails by concept because it inverts the content model. Exam caveat: CIS-RC parallels risk statement/risk with control objective/control. Operational check: open a wastewater risk statement, generate a scoped risk on the plant entity, and confirm scoring, ownership, and treatment fields exist on the risk instance while the statement remains the reusable definition. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.